{"id":"bdf54bbc-9dce-4505-9257-d747909c2d32","arxiv_id":"2608.09885","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"An LLM-agent safety harness can be decomposed into four editable parts and evolved from rollout trajectories, cutting attack success rate from 17.1% to 5.5% on Agent-SafetyBench while improving utility.","lead":"This paper introduces SHE, a system that automatically updates an LLM agent's safety harness, meaning its prompts, rules, memory, and tool restrictions, by learning from past task trajectories. The authors report that after evolution the harness blocks several times more attacks on an agent-safety benchmark while also improving task completion.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The headline ASR/UA gains are selected under a safety–utility rule judged by GPT-5.5, the same model that generates the harness edits; without an independent judge on Agent-SafetyBench the measured improvements may partly reflect optimization to that judge's blind spots.","rationale":"The reader identified the same load-bearing weakness: the evolution model and the Agent-SafetyBench judge are both GPT-5.5, creating a circularity in the selection loop. I agree this is the most serious threat to the central claim. The held-out AgentHarm result with GPT-4o is genuinely helpful evidence, but it does not fully settle the concern because it tests only the final harness, not the evolution/selection procedure, and the main benchmark claims still depend on the same-model judge. A concrete independent-judge re-scoring of the stored trajectories would directly test whether the measured ASR/UA gains are robust or judge-specific. The reader's conditional verdict already accounts for this risk, so I do not propose changing the verdict. Additional concerns, such as the unfair adaptive-baseline comparison and lack of variance reporting, are real but secondary; the same-model judge is the load-bearing issue.","tokens_in":13927,"tokens_out":3699,"duration_ms":36155,"concrete_test":"Re-run the full Agent-SafetyBench evaluation of SHE(seed) and SHE(evolved) using GPT-4o (or another independent full-trajectory judge) on the same stored trajectories and the same scoring template, computing Clean UBR, ASR, and UA. If the evolved-vs-seed deltas and the comparison against SafeHarness are preserved, the judge-overlap concern is largely resolved. If the deltas shrink substantially or reverse, the headline results are at least partly judge-overfit and the central claim is weakened.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim (abstract; §4.2) rests on Agent-SafetyBench safety and utility scores SΩ and UΩ produced by GPT-5.5 as the full-trajectory judge (Appendix A). GPT-5.5 is also the evolution model: it produces structured diagnoses (§3.4), routes failures, generates the bounded edits Δ⁽ᵏ⁾ in Eq. (6), performs the validity check in Eq. (7), and provides the metric values used in the acceptance rule in Eq. (9). Every harness that survives selection is therefore optimized under one model's classification of 'safe' and 'task complete'. The validity check is intended to reject reward-hacking or evaluator-specific shortcuts, but it is the same model checking its own edits against its own judgments, so it cannot independently certify that a gain is not judge-specific. The held-out AgentHarm evaluation uses GPT-4o, which is a useful partial check, but it evaluates only the final fixed harness, not the selection process, and the main benchmark numbers still rest on the same-model judge. If GPT-5.5 has systematic labeling blind spots, the reported 8.6%→5.5% ASR reduction and 33.5%→47.6% UA gain could be partly an artifact of optimizing to those blind spots rather than a genuine safety and utility improvement.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Safety Harness Evolution (SHE), a framework that evolves an LLM agent's safety harness from rollout trajectories. SHE decomposes the harness into four artifacts (System Prompt, Rule Bank, Safety Memory, Tool Policy) and runs an attribution-guided loop that diagnoses trajectory failures, routes them to responsible artifacts, generates bounded edits, validates them, and accepts edits only when they improve the safety score SΩ without reducing the utility score UΩ. On Agent-SafetyBench, the evolved harness is reported to reduce average ASR from 8.6% to 5.5% over the seed harness and from 17.1% to 5.5% over static SafeHarness, while improving average UA from 33.5% to 47.6%. The evolved harness is also reported to generalize to held-out AgentHarm and to transfer across agent models. The central claim is that harnesses can be evolved automatically from trajectories without sacrificing utility.","tokens_in":14160,"tokens_out":5493,"duration_ms":48800,"significance":"If the evaluation concerns are resolved, the paper makes a useful contribution: the artifact-level decomposition is clean and well motivated, the evolution loop is clearly specified, and the held-out AgentHarm evaluation with a different judge (GPT-4o) plus the cross-model transfer experiments provide partial independent validation. The paper also gives concrete evolution history and artifact-structure details in the appendices, which helps reproducibility. However, the primary Agent-SafetyBench metric is judged by the same model that generates and validates the edits, and the paper reports no error bars; these issues directly affect the strength of the central claim.","major_comments":[{"comment":"The central claim in §4.2 rests on Agent-SafetyBench safety and utility scores SΩ and UΩ computed by GPT-5.5, which is also the model that performs structured diagnoses, generates the bounded edits Δ^(k) in Eq. (6), and runs the validity check in Eq. (7). The acceptance rule in Eq. (9) therefore selects harnesses against the same model's judgments that generated and validated the edits; the validity check cannot independently certify that a gain is not a judge-specific shortcut because the same system checks its own edits against its own judgments. The held-out AgentHarm evaluation with GPT-4o is a useful partial check, but it evaluates only the final fixed harness, not the candidate-selection process, and it uses a different benchmark, so it does not establish that the Agent-SafetyBench ASR/UA numbers are free of optimization to the judge. Please re-evaluate at least the final harness, and ideally all accepted candidate harnesses, on Agent-SafetyBench with an independent judge (e.g., GPT-4o, a different model, or human annotation with agreement statistics), and report those numbers alongside the current ones.","section":"§3.4, Eq. (9); §4.1; Appendix A"},{"comment":"The paper reports average ASR, Clean UBR, and UA values without error bars, confidence intervals, or hypothesis tests. The headline ASR reduction from 8.6% to 5.5% is only 3.1 percentage points, and with two rollout replications per evolution task and a single evaluation pass on the 185 held-out tasks, the reported differences may be within run-to-run noise. The statement that temperature 0 ensures deterministic evaluation is not sufficient to remove all sampling variance, and no seeds are reported. Please provide variance estimates across repeated evaluation runs, or bootstrap over tasks, and state the number of independent trajectories behind each cell in Tables 1–3.","section":"§4.1; Tables 1–3"},{"comment":"The cross-model transfer claim is presented only through a figure without numeric values, error bars, or task-level breakdowns, and it is unclear how many rollouts were collected for each target model. Please report Table-1-style numbers for each target model, including the number of trajectories and evaluation conditions, so the transfer claim can be assessed independently.","section":"§4.3, Figure 3"},{"comment":"The evolution-model ablation in Table 3 does not address the same-judge concern because the evaluation protocol is kept unchanged, so GPT-5.5 remains the judge for all variants. This ablation shows robustness to the editing model, but it cannot distinguish genuine safety improvement from optimization to GPT-5.5's judgments. Please also vary the judge independently of the editing model, or report the AgentHarm (GPT-4o) numbers for each evolution-model variant.","section":"Table 3"}],"minor_comments":[{"comment":"The problem setup says SHE improves SΩ(H) 'subject to a utility constraint on UΩ(H)', but no formal constraint is defined before Eq. (9); Eq. (9) later imposes non-decreasing utility. Please state the constraint explicitly at the problem-setup stage.","section":"§3.1"},{"comment":"The phrase 'temperature set to 0 to ensure deterministic evaluation' is imprecise; temperature-0 sampling is not guaranteed deterministic across all inference stacks. Please report decoding parameters, random seeds, and any observed nondeterminism.","section":"§4.1"},{"comment":"The column header 'Best round' is ambiguous; please specify whether R03, R05, R17 refer to evolution rounds and what 'best' means under the Eq. (9) selection rule.","section":"Table 3"},{"comment":"The evolution-history plots would benefit from explicit y-axis ranges, labeled units for the metric traces, and clearer markers for the accepted rounds; currently the claimed plateau from R05 to R16 is difficult to verify visually.","section":"Appendix B"},{"comment":"The phrase '3.1× ASR reduction' is ambiguous; please state explicitly that it is the ratio 17.1/5.5 and not a 3.1-percentage-point reduction, and clarify whether this is relative to the SafeHarness baseline only.","section":"Abstract and §4.2"},{"comment":"Please release the exact seed and evolved artifact texts, the diagnosis and edit prompts, and the full edit history in addition to the GitHub link, since the appendix currently shows only templates and field schemas.","section":"Reproducibility"}],"recommendation":"major_revision","confidential_remarks":"The same-model judge issue raised in the stress-test note lands: Eq. (9), Eq. (6), and the Appendix A judge are all GPT-5.5, so the primary metric is optimized and evaluated by the same system. I do not recommend rejection because the held-out AgentHarm result with GPT-4o gives some independent signal, and re-evaluating the Agent-SafetyBench harnesses with an independent judge is a feasible fix within the manuscript's scope. The missing error bars are a second load-bearing issue and should be addressed in the same revision."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Xin,\n\nThe thing to know about this paper: it's a real attempt to make safety harnesses evolvable, not just a wrapper around prompt tuning. SHE splits the harness into four artifacts (system prompt, rule bank, safety memory, tool policy) and runs an attribution-guided loop that turns failure trajectories into localized, validity-checked edits, selected by a strict safety-utility rule. That decomposition and the focus on safety-specific evolution is new relative to prior harness-evolution work on task performance. The component-replacement ablation is a nice touch: swapping an evolved artifact back to seed degrades results, so the learned components actually carry weight.\n\nWhat's good beyond the idea: the paper reports a held-out AgentHarm evaluation using a different judge (GPT-4o), which gives the final harness some independent validation. Cross-model transfer (evolving on DeepSeek-V3.2, applying to Kimi, GLM, MiniMax) is also a useful sanity check. The evolution history in Figure 7 shows that selection matters, and the rejection rule that requires utility non-decrease is conservative, not a hack to inflate safety at all costs.\n\nNow the elephant. The Agent-SafetyBench headline numbers (ASR 8.6%→5.5%, UA 33.5%→47.6%) come from a judge—GPT-5.5—that is also the evolution model that writes the edits, diagnoses failures, and does the Eq. (7) validity check. That's a circularity, and the paper is honest enough to state it in Appendix A. The validity check does not rescue it: the same model can't independently certify that its own edits aren't exploiting its own blind spots. The held-out AgentHarm result is a useful partial check, but it only evaluates the final fixed harness, not the selection process. So the main benchmark numbers are, at best, \"safe according to GPT-5.5's own standard,\" and at worst, partly an artifact of judge optimization.\n\nOther soft spots: no error bars or significance tests; evolution is on 15 tasks (90 condition instances) with 2 replications; the baselines are not re-evolved on the same split (Appendix A concedes this); and the dataset is only the first 200 tasks of Agent-SafetyBench. None of these sink the paper on their own, but they add uncertainty.\n\nWho is this for? People building agent infrastructure or studying harness-level safety. The framework is plausible and the implementation exists (code link). It deserves serious refereeing, but the referee should demand an independent judge (or human audit of a sample) on Agent-SafetyBench, variance reporting, and fair re-evolved baselines before the headline claim is accepted.\n\nI'd bring it to reading group and would cite it once the circularity is addressed. Verdict: conditional accept, with the condition being an independent judge.\n\nRegards,\n[Your name]","headline":"SHE's core idea is sound and the held-out results are encouraging, but the headline gains on Agent-SafetyBench are measured by the same model that writes the harness edits, so the numbers need an independent judge before I'd trust them.","tokens_in":14764,"tokens_out":2854,"would_cite":true,"duration_ms":24440,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A safety harness can be evolved from its own rollout trajectories, and the paper shows that on Agent-SafetyBench this reduces average attack success from 17.1% to 5.5% while improving utility under attack.","keywords":["LLM agent safety","safety harness","harness evolution","trajectory-driven evolution","tool-use agents","attack success rate","rule bank","safety memory"],"falsifier":"Re-run the same 20-round evolution on Agent-SafetyBench with an independent judge—a different model or human annotation—scoring safety and utility, keeping the evolution model and all other settings fixed. If the attack-success reduction from 17.1% to 5.5% largely disappears or the utility gain shrinks, the headline result is an artifact of judge self-scoring rather than a safer harness. A weaker test is to rescore the accepted harness's trajectories with a held-out judge and compare the resulting ASR.","tokens_in":13690,"feed_emoji":"🛡️","tokens_out":11963,"duration_ms":97386,"temperature":0.7,"pith_summary":"This paper claims that the safety of a large language model (LLM) agent is shaped as much by the harness around the model—context construction, memory, tool permissions, runtime checks—as by the model weights, and that this harness can improve automatically from its own experience. The proposed framework, SHE, splits the harness into four editable artifacts with explicit safety responsibilities, then runs an attribution-guided loop: failed rollouts are diagnosed into structured risk records, each failure is routed to the artifact that should have caught it, and a candidate edit is kept only if it improves safety without reducing utility. On Agent-SafetyBench, it reports lowering average attack success rate from 8.6% (seed harness) and from 17.1% (static SafeHarness baseline) to 5.5%, while raising average utility under attack from about 31.6% to 47.6%. The evolved harness is also shown to reduce harm on the held-out AgentHarm benchmark and to transfer to other agent models without further evolution. If correct, this means safety guardrails can keep learning after deployment rather than remaining frozen at initial specification.","feed_headline":"Evolved harness cuts LLM-agent attack success from 17.1% to 5.5%","feed_subtitle":"SHE rewrites its own rules and tool permissions from failed rollouts, improving utility while blocking more attacks.","key_machinery":"The key mechanism is a four-artifact harness tuple $H = (P_{\\rm sys}, R_{\\rm bank}, M_{\\rm safe}, Q_{\\rm tool})$ combined with an attribution-guided evolution loop. The four artifacts—System Prompt, Rule Bank, Safety Memory, Tool Policy—each have a single explicit safety responsibility, so a failure can be attributed to one component and edits can stay local. The loop converts each rollout trajectory into a structured diagnosis (harm domain, attack surface, failure mode), routes it to the responsible artifact, proposes a bounded edit, rejects edits that look like surface-level safety gains via a validity check, and accepts the candidate only when safety improves and utility does not drop, as in Eq. (9). This combination of local attribution and global safety–utility selection is what lets the harness learn new boundaries without regressing normal task performance.","core_discovery":"The paper's central claim is that trajectory feedback can be converted into localized, verifiable edits to a safety harness. The harness is represented as a tuple of four artifacts—System Prompt (the global behavioral contract), Rule Bank (structured rules with conditions and interventions), Safety Memory (contrastive boundaries from unresolved failures), and Tool Policy (tool-use authority and runtime detectors). Each evolution round rolls out the agent under the current best harness, diagnoses safety-relevant trajectories into harm domain, attack surface, and failure mode, routes the diagnosis to the responsible artifact, and generates a bounded edit. The edit is accepted only when the candidate harness passes a validity check and satisfies the safety–utility selection rule $S_\\Omega(\\tilde H)>S_\\Omega(H_{\\rm best})$ and $U_\\Omega(\\tilde H)\\ge U_\\Omega(H_{\\rm best})$. The accepted run of this loop is what produces the reported 3.1× ASR reduction over the static baseline, the utility gain, and the transferable harness.","pith_inferences":["Extending beyond the paper, the attribution-guided loop is not specific to safety: any trajectory-level objective that can be scored (task success, cost, latency, compliance) could drive the same artifact edits, so the architecture may generalize to general harness optimization.","Because the held-out AgentHarm evaluation uses a different judge than the evolution loop, it already provides a partial check against judge-overfitting; a stronger variant would hold out entire risk categories, not just tasks, and confirm the evolved rules still transfer.","The component-replacement ablations show each artifact contributes, but they do not reveal which artifact transfers best across models; porting only the Rule Bank or Tool Policy to a new agent and measuring retained safety would make cross-model transfer cheaper and better understood."],"forward_implications":["Safety harnesses can keep improving after deployment: new failure trajectories from production or red-teaming can be fed into the same loop to tighten boundaries without rewriting the whole harness.","The four-artifact decomposition gives a reusable unit for failure attribution, so a single unsafe behavior can be traced to a specific editable component instead of triggering a global change.","Because the evolved harness transfers across agent models, one evolution run on a strong base agent may supply safety boundaries for several downstream models, reducing per-model safety engineering.","The safety–utility selection rule blocks edits that trade capability for safety, which means the loop can be run repeatedly without degrading normal task performance."],"supporting_citations":[{"why":"Supplies Agent-SafetyBench, the 2,000-task benchmark with clean and five attack conditions used for evolution and held-in evaluation.","marker":"Zhang et al., 2024"},{"why":"Supplies AgentHarm, the held-out benchmark used to test whether evolved boundaries generalize to unseen multi-step harmful behaviors.","marker":"Andriushchenko et al., 2025"},{"why":"Provides SafeHarness, the static lifecycle-defense baseline whose 17.1% ASR SHE is compared against, and Memskill-SafeHarness, the trajectory-updated baseline.","marker":"Lin et al., 2026b"},{"why":"Provides LlamaFirewall, the runtime-guardrail baseline used as a static control in the safety–utility comparison.","marker":"Chennabasappa et al., 2025"},{"why":"Provides PROGENT, the privilege-control baseline used as an evolved control in the safety–utility comparison.","marker":"Shi et al., 2025"},{"why":"Names GPT-5.5, the evolution model that diagnoses failures, generates edits, and judges Agent-SafetyBench, making it central to the reported gain.","marker":"OpenAI, 2026"},{"why":"Names DeepSeek-V3.2, the fixed base agent model on which harness evolution is run and for which transfer results are reported.","marker":"Liu et al., 2025"}],"fun_headline_variants":["SHE harness evolves to cut LLM attack success 3.1x","LLM agent safety improved 3.1x via harness evolution","SHE: Safety harness that learns from failed rollouts","Trajectory-driven harness evolution cuts LLM attack rate 3.1x","From rollouts to safer agents: SHE harness evolution"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the model scoring safety and utility on Agent-SafetyBench is a faithful judge, because the same model also proposes the harness edits and diagnoses failures; a biased or gameable judge would mean the reported attack-success reduction could reflect optimization to the judge rather than genuine safety improvement.","fun_headline_variants_meta":{"raw":{"variants":["SHE harness evolves to cut LLM attack success 3.1x","LLM agent safety improved 3.1x via harness evolution","SHE: Safety harness that learns from failed rollouts","Trajectory-driven harness evolution cuts LLM attack rate 3.1x","From rollouts to safer agents: SHE harness evolution"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000866,"raw_usage":{"total_tokens":3761,"prompt_tokens":963,"completion_tokens":2798,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":579,"completion_tokens_details":{"reasoning_tokens":2707}},"tokens_in":579,"tokens_out":2798,"duration_ms":18925,"temperature":1.0,"reasoning_tokens":2707,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T04:57:31.014565+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run the same 20-round evolution on Agent-SafetyBench with an independent judge—a different model or human annotation—scoring safety and utility, keeping the evolution model and all other settings fixed. If the attack-success reduction from 17.1% to 5.5% largely disappears or the utility gain shrinks, the headline result is an artifact of judge self-scoring rather than a safer harness. A weaker test is to rescore the accepted harness's trajectories with a held-out judge and compare the resulting ASR.","supporting_citations":[{"cited_title":"R-Judge: Benchmarking safety risk awareness for LLM agents","cited_arxiv_id":null,"evidence_quote":"Supplies Agent-SafetyBench, the 2,000-task benchmark with clean and five attack conditions used for evolution and held-in evaluation."},{"cited_title":"Accessed: 2026-07-26","cited_arxiv_id":null,"evidence_quote":"Names GPT-5.5, the evolution model that diagnoses failures, generates edits, and judges Agent-SafetyBench, making it central to the reported gain."}],"review_version":1}